From ee767edb959e137a234560250280a31e99696660 Mon Sep 17 00:00:00 2001
From: Ian Keane <ian@keane.sh>
Date: Wed, 19 Aug 2026 13:45:22 -0400
Subject: [PATCH] Add tailscale

---
 charts/tailscale/Chart.yaml                   |  5 ++++
 .../tailscale/templates/external-secret.yaml  | 25 ++++++++++++++++
 charts/tailscale/values.yaml                  |  5 ++++
 manifests/cluster/tailscale.yaml              | 30 +++++++++++++++++++
 4 files changed, 65 insertions(+)
 create mode 100644 charts/tailscale/Chart.yaml
 create mode 100644 charts/tailscale/templates/external-secret.yaml
 create mode 100644 charts/tailscale/values.yaml
 create mode 100644 manifests/cluster/tailscale.yaml

diff --git a/charts/tailscale/Chart.yaml b/charts/tailscale/Chart.yaml
new file mode 100644
index 0000000..0aa1353
--- /dev/null
+++ b/charts/tailscale/Chart.yaml
@@ -0,0 +1,5 @@
+apiVersion: v2
+name: tailscale-config
+description: Tailscale operator ExternalSecret for OAuth credentials
+type: application
+version: 0.1.0
diff --git a/charts/tailscale/templates/external-secret.yaml b/charts/tailscale/templates/external-secret.yaml
new file mode 100644
index 0000000..297fd97
--- /dev/null
+++ b/charts/tailscale/templates/external-secret.yaml
@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: operator-oauth
+  namespace: tailscale
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: aws-secrets-manager
+    kind: ClusterSecretStore
+  target:
+    name: operator-oauth
+    template:
+      data:
+        client_id: "{{ .client_id }}"
+        client_secret: "{{ .client_secret }}"
+  data:
+    - secretKey: client_id
+      remoteRef:
+        key: dumpnet
+        property: tailscale.oauth_client_id
+    - secretKey: client_secret
+      remoteRef:
+        key: dumpnet
+        property: tailscale.oauth_client_secret
diff --git a/charts/tailscale/values.yaml b/charts/tailscale/values.yaml
new file mode 100644
index 0000000..331b313
--- /dev/null
+++ b/charts/tailscale/values.yaml
@@ -0,0 +1,5 @@
+# Leave oauth block empty - operator uses precreated 'operator-oauth' secret
+# created by ExternalSecret in charts/tailscale/templates/
+oauth:
+  clientId: ""
+  clientSecret: ""
diff --git a/manifests/cluster/tailscale.yaml b/manifests/cluster/tailscale.yaml
new file mode 100644
index 0000000..df5f4b7
--- /dev/null
+++ b/manifests/cluster/tailscale.yaml
@@ -0,0 +1,30 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: tailscale
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://pkgs.tailscale.com/helmcharts
+      chart: tailscale-operator
+      targetRevision: "*"
+      helm:
+        valueFiles:
+          - $values/charts/tailscale/values.yaml
+    - repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+      targetRevision: HEAD
+      path: charts/tailscale
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: tailscale
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true